@camstack/addon-post-analysis 1.2.117 → 1.2.119

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-Dk-BdVHw.js");
+const require_dist = require("../dist-BtIolp2d.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -4398,10 +4398,28 @@ var SCENE_LATCH_INDEXES = [{
 function sceneKey(deviceId, monitorId) {
 	return `${deviceId}:${monitorId}`;
 }
+/**
+* Reseed cap for BOTH scene ledgers.
+*
+* `DurableLedger` defaults to 100_000 and its own docblock says the owner "sets
+* it from the row set it expects". Neither scene ledger did, so the 30s
+* reconcile asked SQLite — through hub-main's event loop, which is the
+* cluster's only queue (D181) — for up to a hundred thousand rows twice a tick,
+* on a hub holding one scene and one latch (measured live 2026-08-25). A bound
+* nobody chose is not a bound.
+*
+* A scene is an operator-drawn monitor on ONE camera and a latch is at most one
+* row per scene, so the row set is `cameras x monitors-per-camera`. 5_000 is
+* ~5 monitors on each of a thousand cameras — far past any installation this
+* ships to, and still small enough that a runaway write loop is CAUGHT by the
+* bound instead of being paged in whole.
+*/
+var SCENE_LEDGER_LOAD_LIMIT = 5e3;
 var SCENE_CONFIG_SPEC = {
 	collection: SCENE_COLLECTION,
 	columns: SCENE_COLUMNS,
 	indexes: SCENE_INDEXES,
+	loadLimit: SCENE_LEDGER_LOAD_LIMIT,
 	writeMode: "write-behind",
 	keyOf: (row) => row.key,
 	toValue: (row) => ({
@@ -4417,6 +4435,7 @@ var SCENE_LATCH_SPEC = {
 	collection: SCENE_LATCH_COLLECTION,
 	columns: SCENE_LATCH_COLUMNS,
 	indexes: SCENE_LATCH_INDEXES,
+	loadLimit: SCENE_LEDGER_LOAD_LIMIT,
 	writeMode: "write-through",
 	keyOf: (row) => row.key,
 	toValue: (row) => ({
@@ -4446,6 +4465,9 @@ var SceneStore = class {
 	config;
 	latch;
 	logger;
+	/** `scenes/latches` as last announced. Null until the first load, so the
+	*  first one always speaks. */
+	lastLoggedCounts = null;
 	constructor(deps) {
 		this.logger = deps.logger;
 		this.config = new DurableLedger({
@@ -4470,10 +4492,20 @@ var SceneStore = class {
 	* a container recreate, "loaded 0" is the one line that explains why every
 	* scene suddenly reads `unknown`, and its absence is what turns a data loss
 	* into a three-hour hunt.
+	*
+	* ON CHANGE ONLY, though — including the first load, where there is nothing
+	* to compare against. This runs on the 30s `SCENE_RELOAD_INTERVAL_MS` tick on
+	* every node, and it used to print unconditionally: measured live 2026-08-25,
+	* `scene state loaded {scenes=1 latches=1}` every 30 seconds forever. A count
+	* reprinted unchanged twice a minute is exactly how the "loaded 0" this line
+	* exists for gets scrolled past.
 	*/
 	async load() {
 		const scenes = await this.config.load();
 		const latches = await this.latch.load();
+		const counts = `${scenes.length}/${latches.length}`;
+		if (counts === this.lastLoggedCounts) return;
+		this.lastLoggedCounts = counts;
 		this.logger.info("scene state loaded", { meta: {
 			scenes: scenes.length,
 			latches: latches.length
@@ -8539,6 +8571,49 @@ var NC_LANGUAGES = ["en", "it"];
 *  surface's view all validate against this one, so a third language is added
 *  to `NC_LANGUAGES` and nowhere else. */
 var NcLanguageSchema = require_dist._enum(NC_LANGUAGES);
+/**
+* Whether two snapshots say the same thing.
+*
+* ## Why this is a function and not `===`
+*
+* The reload guard in `reloadTexts()` used to be
+* `before.overrides === next.overrides`, and `next` comes from
+* `NcTextCatalogStore.load()`, which `parse()`s the row through zod on every
+* call. The right-hand side is therefore a NEW object on every tick by
+* construction: the comparison was `false` at byte-identical content, forever.
+* Measured on the live hub 2026-08-25: 58 "notification texts loaded" lines in
+* 30 minutes on a hub whose language had not changed, from a line whose own
+* docblock promises it fires on CHANGE only.
+*
+* The document is two levels deep and installation-small (at most one entry per
+* language, each a flat key→string map), so the comparison is written out
+* rather than reached for through a deep-equal dependency — and written out it
+* can state the direction that matters: a REMOVED key must not read as equal,
+* which a one-directional key walk would get wrong.
+*/
+function ncTextSnapshotsEqual(a, b) {
+	if (a.language !== b.language) return false;
+	return overrideMapsEqual(a.overrides, b.overrides);
+}
+function overrideMapsEqual(a, b) {
+	const languages = new Set([...Object.keys(a), ...Object.keys(b)]);
+	for (const language of languages) {
+		const left = a[language];
+		const right = b[language];
+		if (left === void 0 || right === void 0) {
+			if (Object.keys(left ?? right ?? {}).length > 0) return false;
+			continue;
+		}
+		if (!flatMapsEqual(left, right)) return false;
+	}
+	return true;
+}
+function flatMapsEqual(a, b) {
+	const keys = Object.keys(a);
+	if (keys.length !== Object.keys(b).length) return false;
+	for (const key of keys) if (a[key] !== b[key]) return false;
+	return true;
+}
 /** The shipped files, keyed by language. Data, never mutated. */
 var NC_TEXT_BUNDLES = {
 	en: en_default,
@@ -22484,7 +22559,7 @@ var NotificationCenter = class NotificationCenter {
 		const before = this.texts.snapshot;
 		const next = await this.textStore.load();
 		this.texts.apply(next);
-		if (before.language === next.language && before.overrides === next.overrides) return;
+		if (ncTextSnapshotsEqual(before, next)) return;
 		this.logger.info("notification texts loaded", { meta: {
 			language: next.language,
 			overriddenKeys: Object.values(next.overrides).reduce((sum, keys) => sum + Object.keys(keys ?? {}).length, 0)
@@ -25924,7 +25999,7 @@ var CLASS_RANK_VEHICLE = .8;
 var CLASS_RANK_ANIMAL = .5;
 var CLASS_RANK_DEFAULT = .25;
 var PERSON_CLASSES = new Set(["person", "face"]);
-var VEHICLE_CLASSES = new Set([
+var VEHICLE_CLASSES$1 = new Set([
 	"vehicle",
 	"car",
 	"truck",
@@ -25955,7 +26030,7 @@ function clamp01$1(x) {
 function classRank(className) {
 	const c = className.toLowerCase();
 	if (PERSON_CLASSES.has(c)) return 1;
-	if (VEHICLE_CLASSES.has(c)) return CLASS_RANK_VEHICLE;
+	if (VEHICLE_CLASSES$1.has(c)) return CLASS_RANK_VEHICLE;
 	if (ANIMAL_CLASSES.has(c)) return CLASS_RANK_ANIMAL;
 	return CLASS_RANK_DEFAULT;
 }
@@ -26558,7 +26633,7 @@ var FaceGalleryProvider = class {
 		const identities = await this.identityStore.listIdentities();
 		const nameMap = new Map(identities.map((i) => [i.id, i.name]));
 		const identityName = face.recognizedIdentityId ? nameMap.get(face.recognizedIdentityId) : void 0;
-		const base64 = await this.faceCropBase64(face);
+		const cropUrl = this.cropUrlFor(face);
 		return {
 			faceId: face.id,
 			deviceId: face.deviceId,
@@ -26567,7 +26642,7 @@ var FaceGalleryProvider = class {
 			...face.recognizedIdentityId != null ? { recognizedIdentityId: face.recognizedIdentityId } : {},
 			...identityName !== void 0 ? { identityName } : {},
 			assigned: face.assigned,
-			...base64 !== void 0 ? { base64 } : {},
+			...cropUrl !== void 0 ? { cropUrl } : {},
 			...face.faceBbox !== void 0 ? { faceBbox: face.faceBbox } : {},
 			...face.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: face.keyFrameMediaKey } : {},
 			...face.bestMatchScore != null ? { bestMatchScore: face.bestMatchScore } : {},
@@ -29687,9 +29762,15 @@ var TrackCloser = class {
 			await this.suppressZeroMedia(t.deviceId, t.trackId);
 			return;
 		}
-		if (outcome === "raster-fallback" && closure?.rasterFallback) await this.commitRasterFallback(t, closure.rasterFallback.jpeg, closure.rasterFallback.timestamp);
+		let thumbnailLanded = ownedMedia.some((m) => m.kind === "thumbnail");
+		if (outcome === "raster-fallback" && closure?.rasterFallback) {
+			await this.commitRasterFallback(t, closure.rasterFallback.jpeg, closure.rasterFallback.timestamp);
+			thumbnailLanded = true;
+		}
 		await this.maybePromoteLastFrame(t, ownedMedia);
-		await this.maybeDeriveThumbnailFromKeyFrame(t, ownedMedia);
+		const hasRasterFallback = closure?.rasterFallback !== void 0;
+		if (!thumbnailLanded) thumbnailLanded = await this.maybeDeriveThumbnailFromKeyFrame(t, ownedMedia, hasRasterFallback);
+		if (!thumbnailLanded && closure?.rasterFallback) await this.commitRasterFallback(t, closure.rasterFallback.jpeg, closure.rasterFallback.timestamp);
 		this.deps.logger.info("track ended", {
 			tags: { deviceId: t.deviceId },
 			meta: {
@@ -29807,14 +29888,23 @@ var TrackCloser = class {
 	* and the rate could only ever be counted from the database, after the fact.
 	* A branch that drops work silently reads as "never happened".
 	*/
-	async maybeDeriveThumbnailFromKeyFrame(t, ownedMedia) {
-		if (ownedMedia.some((m) => m.kind === "thumbnail")) return;
+	async maybeDeriveThumbnailFromKeyFrame(t, ownedMedia, hasRasterFallback) {
+		if (ownedMedia.some((m) => m.kind === "thumbnail")) return true;
 		const derive = this.deps.deriveThumbnailFromKeyFrame;
-		if (!derive) return this.logNoThumbnailAtClose(t, "derive-not-wired");
+		if (!derive) {
+			if (!hasRasterFallback) this.logNoThumbnailAtClose(t, "derive-not-wired");
+			return false;
+		}
 		const keyFrame = ownedMedia.find((m) => m.kind === "keyFrame");
-		if (!keyFrame) return this.logNoThumbnailAtClose(t, "no-key-frame");
+		if (!keyFrame) {
+			if (!hasRasterFallback) this.logNoThumbnailAtClose(t, "no-key-frame");
+			return false;
+		}
 		const bestSeen = this.deps.residents.bestSeenBbox(t.trackId);
-		if (!bestSeen) return this.logNoThumbnailAtClose(t, "no-best-seen-bbox");
+		if (!bestSeen) {
+			if (!hasRasterFallback) this.logNoThumbnailAtClose(t, "no-best-seen-bbox");
+			return false;
+		}
 		try {
 			const derived = await derive({
 				mediaKey: keyFrame.key,
@@ -29826,17 +29916,23 @@ var TrackCloser = class {
 				},
 				frameWidth: bestSeen.frameWidth,
 				frameHeight: bestSeen.frameHeight,
-				timestamp: bestSeen.timestamp
+				timestamp: keyFrame.timestamp
 			});
-			if (!derived) return this.logNoThumbnailAtClose(t, "derive-returned-null", { keyFrameKey: keyFrame.key });
+			if (!derived) {
+				if (!hasRasterFallback) this.logNoThumbnailAtClose(t, "derive-returned-null", { keyFrameKey: keyFrame.key });
+				return false;
+			}
 			const mediaStore = this.deps.mediaStore();
-			if (!mediaStore) return this.logNoThumbnailAtClose(t, "no-media-store");
+			if (!mediaStore) {
+				if (!hasRasterFallback) this.logNoThumbnailAtClose(t, "no-media-store");
+				return false;
+			}
 			await mediaStore.put({
 				deviceId: t.deviceId,
 				ownerKind: "track",
 				ownerId: t.trackId,
 				kind: "thumbnail",
-				timestamp: bestSeen.timestamp,
+				timestamp: keyFrame.timestamp,
 				data: derived.thumbnail
 			});
 			await mediaStore.put({
@@ -29844,7 +29940,7 @@ var TrackCloser = class {
 				ownerKind: "track",
 				ownerId: t.trackId,
 				kind: "thumbnailSmall",
-				timestamp: bestSeen.timestamp,
+				timestamp: keyFrame.timestamp,
 				data: derived.thumbnailSmall
 			});
 			this.deps.logger.info("thumbnail derived from keyFrame at close (no live best-shot landed)", {
@@ -29855,6 +29951,7 @@ var TrackCloser = class {
 					skewMs: derived.skewMs
 				}
 			});
+			return true;
 		} catch (err) {
 			this.deps.logger.debug("close-time keyFrame thumbnail derive failed", {
 				tags: { deviceId: t.deviceId },
@@ -29863,10 +29960,11 @@ var TrackCloser = class {
 					error: String(err)
 				}
 			});
-			this.logNoThumbnailAtClose(t, "derive-threw", {
+			if (!hasRasterFallback) this.logNoThumbnailAtClose(t, "derive-threw", {
 				keyFrameKey: keyFrame.key,
 				error: String(err)
 			});
+			return false;
 		}
 	}
 	/**
@@ -30736,6 +30834,7 @@ var PlateGalleryProvider = class {
 	logger;
 	refreshGallery;
 	emitPlateGalleryChanged;
+	eventMediaBaseUrl;
 	constructor(deps) {
 		this.plateStore = deps.plateStore;
 		this.vehicleStore = deps.vehicleStore;
@@ -30745,6 +30844,7 @@ var PlateGalleryProvider = class {
 		this.logger = deps.logger;
 		this.refreshGallery = deps.refreshGallery;
 		this.emitPlateGalleryChanged = deps.emitPlateGalleryChanged;
+		this.eventMediaBaseUrl = deps.eventMediaBaseUrl;
 	}
 	/** Best-effort emit — never allowed to fail the mutation it follows. */
 	safeEmitPlateGalleryChanged(payload) {
@@ -30752,6 +30852,12 @@ var PlateGalleryProvider = class {
 			this.emitPlateGalleryChanged(payload);
 		} catch {}
 	}
+	cropUrlFor(plate) {
+		if (plate.mediaKey === void 0 || plate.mediaKey === "") return void 0;
+		const base = this.eventMediaBaseUrl();
+		if (base === null) return void 0;
+		return `${base}/${encodeURIComponent(plate.mediaKey)}`;
+	}
 	async plateCropBase64(plate) {
 		if (plate.mediaKey) {
 			const m = await this.mediaStore.getByKey(plate.mediaKey);
@@ -30760,8 +30866,9 @@ var PlateGalleryProvider = class {
 		const media = await this.mediaStore.listByOwner("plate", plate.id);
 		return media.length > 0 ? media[0].base64 : void 0;
 	}
-	async toPlateInfo(plate, nameMap) {
-		const base64 = await this.plateCropBase64(plate);
+	async toPlateInfo(plate, nameMap, opts) {
+		const base64 = opts?.includeCrops ?? true ? await this.plateCropBase64(plate) : void 0;
+		const cropUrl = this.cropUrlFor(plate);
 		const vehicleName = plate.recognizedVehicleId != null ? nameMap?.get(plate.recognizedVehicleId) : void 0;
 		return {
 			plateId: plate.id,
@@ -30776,7 +30883,8 @@ var PlateGalleryProvider = class {
 			...vehicleName !== void 0 ? { vehicleName } : {},
 			...plate.plateBbox !== void 0 ? { plateBbox: plate.plateBbox } : {},
 			...plate.keyFrameMediaKey !== void 0 ? { keyFrameMediaKey: plate.keyFrameMediaKey } : {},
-			...base64 !== void 0 ? { base64 } : {}
+			...base64 !== void 0 ? { base64 } : {},
+			...cropUrl !== void 0 ? { cropUrl } : {}
 		};
 	}
 	async vehicleNameMap() {
@@ -30795,7 +30903,7 @@ var PlateGalleryProvider = class {
 		const plate = await this.plateStore.get(`plate-${input.trackId}`);
 		if (!plate || plate.deviceId !== input.deviceId) return null;
 		const nameMap = await this.vehicleNameMap();
-		return this.toPlateInfo(plate, nameMap);
+		return this.toPlateInfo(plate, nameMap, { includeCrops: false });
 	}
 	async getPlateMedia(input) {
 		return (await this.mediaStore.listByOwner("plate", input.plateId)).map((m) => ({
@@ -35426,6 +35534,18 @@ var EmbeddingDispatcher = class {
 	logger;
 	getRemoteFrame;
 	lastEmbedTime = /* @__PURE__ */ new Map();
+	/**
+	* trackId -> the frame pinned for it. Each entry holds a WHOLE decoded RGB
+	* frame (`PendingCrop.frameData`, ~0.7 MB), not a crop.
+	*
+	* Under the shipped `cropStrategy: 'first'` this doubles as the in-flight
+	* DEDUPE FLAG — `'first'` gates on `!pendingCrops.has(trackId)` — and there
+	* is no flush timer for that strategy, so nothing ever sweeps it. Until
+	* 2026-08-25 the delete lived on `processOne`'s success path only: an
+	* `extractCrop` throw or an `encoder.encode` rejection (a cross-process cap
+	* over UDS, with no timeout) stranded the frame permanently AND made that
+	* trackId un-embeddable forever. `processOne` now releases in a `finally`.
+	*/
 	pendingCrops = /* @__PURE__ */ new Map();
 	flushTimer = null;
 	unsubscribe = null;
@@ -35583,7 +35703,6 @@ var EmbeddingDispatcher = class {
 			this._processedCount++;
 			this._totalInferenceMs += inferenceMs;
 			this.lastEmbedTime.set(pending.deviceId, Date.now());
-			this.pendingCrops.delete(pending.trackId);
 			const embeddingId = `${pending.deviceId}/${pending.trackId}/${Date.now()}`;
 			const payload = {
 				deviceId: Number(pending.deviceId),
@@ -35615,8 +35734,21 @@ var EmbeddingDispatcher = class {
 					error: String(err)
 				}
 			});
+		} finally {
+			if (this.pendingCrops.get(pending.trackId) === pending) this.pendingCrops.delete(pending.trackId);
 		}
 	}
+	/**
+	* Decoded frames currently pinned in {@link pendingCrops}.
+	*
+	* ~0.7 MB each (a whole RGB detection frame, not a crop), so this number IS
+	* the dispatcher's memory footprint. Exposed because the entries are
+	* invisible in every functional read: a stranded one looks exactly like a
+	* track that was never detected.
+	*/
+	pendingFrameCount() {
+		return this.pendingCrops.size;
+	}
 };
 /**
 * Re-embed every listed track from its key frame.
@@ -35936,6 +36068,19 @@ function createEventMediaHandler(deps) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/copy-face-crop-preview.ts
+var TRACK_PREVIEW_KINDS = new Set(["thumbnail", "thumbnailSmall"]);
+async function copyFaceCropIfTrackHasNoThumbnail(store, input) {
+	if ((await store.listTrackMedia(input.trackId)).some((m) => TRACK_PREVIEW_KINDS.has(m.kind))) return false;
+	await store.putTrackThumbnail({
+		deviceId: input.deviceId,
+		trackId: input.trackId,
+		timestamp: input.timestamp,
+		data: input.crop
+	});
+	return true;
+}
+//#endregion
 //#region src/pipeline-analytics/event-thumbnail-resolver.ts
 /** Pick an event-OWNED media blob: the tight `crop`, else the native-res boxed
 *  `fullFrameBoxed`, else any available file. Both preferred kinds are RETIRED
@@ -35944,29 +36089,47 @@ function createEventMediaHandler(deps) {
 function pickEventOwnedMedia(files) {
 	return files.find((f) => f.kind === "crop") ?? files.find((f) => f.kind === "fullFrameBoxed") ?? files[0];
 }
-/** Pick a track's fallback media in the shared cadence-preference order the
-*  KeyEvent path uses: `thumbnailSmall` (480 fast-load) → best `thumbnail` →
-*  rolling `lastFrame` → `firstFrame` → newest `snapshot` → any track blob.
-*  Undefined when the track owns no media. */
+/** Pick a track's fallback media when no subject crop exists: `thumbnailSmall`
+*  → `thumbnail` → native `keyFrameSmall`/`keyFrame`/`fullFrame` → rolling
+*  `lastFrame` → `firstFrame` → newest `snapshot` → any blob. A full frame
+*  beats a class icon. Undefined when the owner has no media. */
 function pickTrackFallbackMedia(files) {
-	return files.find((f) => f.kind === "thumbnailSmall") ?? files.find((f) => f.kind === "thumbnail") ?? files.find((f) => f.kind === "lastFrame") ?? files.find((f) => f.kind === "firstFrame") ?? [...files].reverse().find((f) => f.kind === "snapshot") ?? files[files.length - 1];
+	return files.find((f) => f.kind === "thumbnailSmall") ?? files.find((f) => f.kind === "thumbnail") ?? files.find((f) => f.kind === "keyFrameSmall") ?? files.find((f) => f.kind === "keyFrame") ?? files.find((f) => f.kind === "fullFrame") ?? files.find((f) => f.kind === "lastFrame") ?? files.find((f) => f.kind === "firstFrame") ?? [...files].reverse().find((f) => f.kind === "snapshot") ?? files[files.length - 1];
 }
 /**
-* Crop-forced resolution (the `?kind=crop` reel/timeline path). Prefer a CLEAN
-* (never-boxed) frame via the injected `pickClean`; when the track owns NO clean
-* frame at all — the regression class created by retiring `crop`/`fullFrame`
-* production (2026-07-21), leaving degenerate tracks with only boxed
-* `lastFrame`/`snapshot`/`firstFrame` — degrade to ANY track media rather than
-* returning undefined. A boxed frame (with the target's box drawn) is a real
-* preview; an empty tile is not. Clean is always tried FIRST so the common case
-* still serves an unboxed tile. Undefined only when the owner has NO media.
+* Crop-forced resolution (the `?kind=crop` / `?kind=thumbnailSmall` reel path).
+*
+* Ladder: body crop (track/event thumbnail) → tight face/plate crop → any
+* remaining image (keyFrame / lastFrame / …). The class icon is only honest
+* when the owner has no stored bytes at all.
 *
 * `pickClean` is injected because the clean-kind picker (`pickCleanMedia`) lives
 * in the addon `index.ts` over the concrete `MediaFileKind` set; this keeps the
 * composition pure + unit-testable here.
 */
-function resolveCropForcedMedia(files, pickClean) {
-	return pickClean(files) ?? pickTrackFallbackMedia(files);
+function resolveCropForcedMedia(files, pickClean, detailFiles = []) {
+	return pickClean(files) ?? pickClean(detailFiles) ?? pickTrackFallbackMedia([...files, ...detailFiles]);
+}
+/**
+* Event + track media (the body/scene) and face/plate media (the detail
+* crops). Face rows live under `face-${trackId}`; a track can close with
+* `hasEmbeddedFace` and ZERO track files (0e343f86).
+*/
+async function collectCropForcedMedia(source, id) {
+	const eventFiles = await source.listByOwner("event", id);
+	const trackFiles = await source.listByOwner("track", id);
+	const ownerTrackId = trackFiles.length === 0 ? await source.getTrackIdForEvent(id) : null;
+	const owningTrackFiles = ownerTrackId === null ? [] : await source.listByOwner("track", ownerTrackId);
+	const trackId = ownerTrackId ?? id;
+	const [faceFiles, plateFiles] = await Promise.all([source.listByOwner("face", `face-${trackId}`), source.listByOwner("plate", `plate-${trackId}`)]);
+	return {
+		bodyFiles: [
+			...eventFiles,
+			...trackFiles,
+			...owningTrackFiles
+		],
+		detailFiles: [...faceFiles, ...plateFiles]
+	};
 }
 /**
 * Resolve the default-path media for an event id: the event's own media when it
@@ -35980,6 +36143,14 @@ async function resolveDefaultEventMedia(deps) {
 	return pickTrackFallbackMedia(await deps.listTrackMedia(trackId)) ?? null;
 }
 //#endregion
+//#region src/pipeline-analytics/ensure-track-hierarchy.ts
+async function ensureTrackHierarchyMedia(deps, input) {
+	const tasks = [];
+	if (!deps.isThumbnailLanded(input.trackId)) tasks.push(deps.captureBodyThumbnail(input));
+	if (!deps.isKeyFrameLanded(input.trackId)) tasks.push(deps.captureKeyFrame(input));
+	await Promise.all(tasks);
+}
+//#endregion
 //#region src/pipeline-analytics/face-settings.ts
 /**
 * Per-device face-recognition settings. Cascade: a per-device override on top
@@ -36498,6 +36669,21 @@ var FaceRecognizer = class {
 					...held,
 					crop
 				});
+				if (crop !== void 0 && input.frameHandle !== void 0) this.deps.onLiveHierarchy?.({
+					deviceId: input.deviceId,
+					trackId: c.trackId,
+					timestamp: input.timestamp,
+					bodyBbox: {
+						x: c.bbox.x,
+						y: c.bbox.y,
+						w: c.bbox.w,
+						h: c.bbox.h
+					},
+					frameWidth: input.frameWidth,
+					frameHeight: input.frameHeight,
+					cropPadding: input.cropPadding,
+					frameHandle: input.frameHandle
+				});
 				this.deps.logger.debug("face: best-face held", {
 					tags: {
 						deviceId: input.deviceId,
@@ -36647,6 +36833,22 @@ var FaceRecognizer = class {
 			});
 			return;
 		}
+		try {
+			await this.deps.copyCropToTrackPreview?.({
+				deviceId,
+				trackId,
+				crop: held.crop,
+				timestamp: held.timestamp
+			});
+		} catch (err) {
+			this.deps.logger.debug("face: track preview copy failed", {
+				tags: { deviceId },
+				meta: {
+					trackId,
+					error: String(err)
+				}
+			});
+		}
 		const keyFrameMediaKey = this.deps.getKeyFrameMediaKey?.(trackId);
 		try {
 			await this.deps.faceStore.insert({
@@ -44227,6 +44429,12 @@ var PlateRecognizer = class {
 			text: c.plateText,
 			score: c.plateScore,
 			bbox: c.plateBbox,
+			bodyBbox: {
+				x: c.bbox.x,
+				y: c.bbox.y,
+				w: c.bbox.w,
+				h: c.bbox.h
+			},
 			timestamp: input.timestamp,
 			frameWidth: input.frameWidth,
 			frameHeight: input.frameHeight,
@@ -44300,6 +44508,16 @@ var PlateRecognizer = class {
 				}
 			});
 		}
+		if (crop !== void 0 && input.frameHandle !== void 0 && input.bodyBbox !== void 0) this.deps.onLiveHierarchy?.({
+			deviceId: input.deviceId,
+			trackId: input.trackId,
+			timestamp: input.timestamp,
+			bodyBbox: input.bodyBbox,
+			frameWidth: input.frameWidth,
+			frameHeight: input.frameHeight,
+			cropPadding: input.cropPadding,
+			frameHandle: input.frameHandle
+		});
 		this.bestPlate.set(input.trackId, {
 			text: input.text,
 			score: input.score,
@@ -48334,14 +48552,23 @@ function isAfterCursor(row, cursor) {
 	if (row.lastSeen < cursor.lastSeen) return true;
 	return row.lastSeen === cursor.lastSeen && row.id < cursor.trackId;
 }
+var VEHICLE_CLASSES = new Set([
+	"vehicle",
+	"car",
+	"truck",
+	"bus"
+]);
+function motionlessMaxPxForClass(className) {
+	return VEHICLE_CLASSES.has(className.toLowerCase()) ? 8 : 40;
+}
 function netDisplacementPx(positions) {
 	const first = positions[0];
 	const last = positions[positions.length - 1];
 	if (!first || !last) return 0;
 	return Math.hypot(last.x - first.x, last.y - first.y);
 }
-function isShortMotionlessTrack(lifeMs, movedPx) {
-	return lifeMs <= 25e3 && movedPx <= 8;
+function isShortMotionlessTrack(lifeMs, movedPx, className) {
+	return lifeMs <= 25e3 && movedPx <= motionlessMaxPxForClass(className);
 }
 //#endregion
 //#region src/pipeline-analytics/store/track-store.ts
@@ -48925,7 +49152,7 @@ var TrackStore = class {
 		for (const [trackId, t] of this.active) {
 			if (nowMs - t.lastSeen < this.config.ttlMs) continue;
 			t.active = false;
-			if (t.positions.length > 0 && isShortMotionlessTrack(t.lastSeen - t.firstSeen, netDisplacementPx(t.positions))) t.closedReason = "stationary-promotion";
+			if (t.positions.length > 0 && isShortMotionlessTrack(t.lastSeen - t.firstSeen, netDisplacementPx(t.positions), t.className)) t.closedReason = "stationary-promotion";
 			const record = cloneTrack(t);
 			try {
 				await this.persistCompleted(record);
@@ -51316,9 +51543,14 @@ function deriveFrameDispatchKind(content) {
 }
 var DEFAULT_MAX_IN_FLIGHT_PER_DEVICE = 3;
 var DEFAULT_LOG_WINDOW_MS = 6e4;
+/** One `capture queue full` line per device per this interval. The condition
+*  holds for as long as the lane is saturated; one line per shed request would
+*  be thousands. */
+var OVERFLOW_WARN_THROTTLE_MS = 6e4;
 var CaptureScheduler = class {
 	logger;
 	budget;
+	maxQueued;
 	windowMs;
 	now;
 	lanes = /* @__PURE__ */ new Map();
@@ -51327,9 +51559,12 @@ var CaptureScheduler = class {
 	/** holdKey → refcount of queued/running requests holding it. */
 	heldKeys = /* @__PURE__ */ new Map();
 	windows = /* @__PURE__ */ new Map();
+	/** Per-device throttle for the `capture queue full` warn. */
+	lastOverflowWarnAt = /* @__PURE__ */ new Map();
 	constructor(options) {
 		this.logger = options.logger;
 		this.budget = options.maxInFlightPerDevice ?? DEFAULT_MAX_IN_FLIGHT_PER_DEVICE;
+		this.maxQueued = Math.max(1, options.maxQueuedPerDevice ?? 24);
 		this.windowMs = options.logWindowMs ?? DEFAULT_LOG_WINDOW_MS;
 		this.now = options.now ?? Date.now;
 	}
@@ -51399,6 +51634,7 @@ var CaptureScheduler = class {
 			failed: w.failed,
 			coalesced: w.coalesced,
 			droppedStale: w.droppedStale,
+			droppedOverflow: w.droppedOverflow,
 			cancelled: w.cancelled,
 			maxQueueDepth: w.maxQueueDepth
 		};
@@ -51447,7 +51683,37 @@ var CaptureScheduler = class {
 			throw err;
 		});
 	}
-	/** Queue an over-budget request (priority-ordered, FIFO within priority). */
+	/**
+	* Queue an over-budget request (priority-ordered, FIFO within priority),
+	* under a BOUND enforced here rather than at dequeue.
+	*
+	* ## Why the queue needs its own bound
+	*
+	* `staleAfterMs` is evaluated in {@link pump}, and `pump` only touches the
+	* queue while `inFlight < budget`. A lane that stays saturated therefore
+	* never inspects its queue at all — nothing expires, nothing is shed, and the
+	* queue grows for as long as the pressure lasts. The budget bounds concurrent
+	* WORK; it has never bounded queued work.
+	*
+	* That gap is not theoretical: the per-frame batch dispatch PINS a ~0.7 MB
+	* copy of the detection frame BEFORE queueing (so ring recycling cannot
+	* invalidate it), and the queued closure holds that copy alive. Measured on
+	* the live hub, `hub/pipeline-analytics` ran at rss=3911MB with heapUsed only
+	* 153MB and arrayBuffers=2281MB — 2.28 GB of JS-reachable Buffers, roughly
+	* 3 200 pinned frames, in a runner whose heap limit is 1216 MB. The call site
+	* that pins them says the cost is "bounded by the lane"; it was not.
+	*
+	* Two things happen on the way in, in this order:
+	*
+	*  1. **expire what is already dead.** Entries past their `staleAfterMs` are
+	*     dropped now. They were doomed the moment they expired; `pump` simply
+	*     never got to look. This is the reclaim that costs nothing.
+	*  2. **shed the least important.** Still over the cap, the TAIL goes — the
+	*     queue is ordered by priority, so the tail is by construction the work
+	*     this scheduler already ranked last. Whether that is the newcomer or an
+	*     older low-priority entry is decided by the same ordering that decides
+	*     execution, so a `firstFrame` never loses its place to an `embed`.
+	*/
 	enqueue(lane, input) {
 		return new Promise((resolve, reject) => {
 			const entry = {
@@ -51460,11 +51726,53 @@ var CaptureScheduler = class {
 				},
 				drop: () => resolve(null)
 			};
+			this.dropExpired(input.deviceId, lane);
 			this.insertByPriority(lane, entry);
+			this.shedToCap(input.deviceId, lane);
 			const w = this.window(input.deviceId);
 			if (lane.queue.length > w.maxQueueDepth) w.maxQueueDepth = lane.queue.length;
 		});
 	}
+	/** Drop every queued entry already past its `staleAfterMs`. Entries without
+	*  one (e.g. `confirm`, which gates track birth) are never expired here. */
+	dropExpired(deviceId, lane) {
+		const nowMs = this.now();
+		for (let i = lane.queue.length - 1; i >= 0; i -= 1) {
+			const entry = lane.queue[i];
+			if (entry === void 0) continue;
+			if (entry.staleAfterMs === void 0 || nowMs - entry.enqueuedAt <= entry.staleAfterMs) continue;
+			lane.queue.splice(i, 1);
+			this.bump(deviceId, "droppedStale");
+			entry.drop();
+		}
+	}
+	/** Shed from the tail (lowest priority, newest within it) until the lane is
+	*  at its cap. Loud: a capture that is dropped rather than merely late is a
+	*  missing thumbnail or first frame, and silence would read as "never asked". */
+	shedToCap(deviceId, lane) {
+		let shed = 0;
+		while (lane.queue.length > this.maxQueued) {
+			const victim = lane.queue.pop();
+			if (victim === void 0) break;
+			this.bump(deviceId, "droppedOverflow");
+			victim.drop();
+			shed += 1;
+		}
+		if (shed === 0) return;
+		const nowMs = this.now();
+		if (nowMs - (this.lastOverflowWarnAt.get(deviceId) ?? Number.NEGATIVE_INFINITY) < OVERFLOW_WARN_THROTTLE_MS) return;
+		this.lastOverflowWarnAt.set(deviceId, nowMs);
+		this.logger.warn("capture queue full — shedding the lowest-priority captures for this camera", {
+			tags: { deviceId },
+			meta: {
+				shed,
+				cap: this.maxQueued,
+				queueDepth: lane.queue.length,
+				inFlight: lane.inFlight,
+				budget: this.budget
+			}
+		});
+	}
 	insertByPriority(lane, entry) {
 		let index = lane.queue.length;
 		while (index > 0) {
@@ -51511,6 +51819,7 @@ var CaptureScheduler = class {
 			failed: 0,
 			coalesced: 0,
 			droppedStale: 0,
+			droppedOverflow: 0,
 			cancelled: 0,
 			maxQueueDepth: 0
 		};
@@ -51535,6 +51844,7 @@ var CaptureScheduler = class {
 				failed: w.failed,
 				coalesced: w.coalesced,
 				droppedStale: w.droppedStale,
+				droppedOverflow: w.droppedOverflow,
 				cancelled: w.cancelled,
 				maxQueueDepth: w.maxQueueDepth,
 				queueDepth: this.queueDepth(deviceId),
@@ -53105,8 +53415,14 @@ var EventMediaDispatcher = class {
 	* scheduler request against a 3-slot device lane and can start seconds late,
 	* by which time the handle's ring slot is usually recycled and the by-handle
 	* resolve in {@link captureForFrame} finds nothing (the 2026-07-23 boxed-tile
-	* regression). ~0.7MB per pinned frame, freed with the batch — bounded by the
-	* lane. Returns `null` on a genuine live-window miss.
+	* regression). ~0.7MB per pinned frame, freed with the batch.
+	*
+	* THE COPY IS ONLY AS BOUNDED AS THE QUEUE THAT HOLDS IT. This said "bounded
+	* by the lane" while the lane bounded in-flight execs (3) and nothing at all
+	* bounded the queue behind them, so a saturated camera accumulated pinned
+	* frames without limit — 2.28 GB of `arrayBuffers` measured on the live hub.
+	* Every caller must therefore pass `staleAfterMs`, and `CaptureScheduler`
+	* caps queue depth per device. Returns `null` on a genuine live-window miss.
 	*
 	* Both miss paths are WARN, throttled to one line per device per minute. They
 	* are the FIRST half of a pair whose second half (`capture batch lost`) has
@@ -56931,10 +57247,12 @@ var CONFIRMATION_CROP_MAX_WIDTH = 320;
 *  a late confirmation is still worth running; see `DEFAULT_CAPTURE_PRIORITY`). */
 var ENRICHMENT_CAPTURE_STALE_MS = 3e3;
 /** Reconcile cadence for the per-device `zones` / `zoneRules` slice handles.
-*  The `device.state-changed` push doesn't reliably reach a forked child, so
-*  each cached proxy re-pulls both slices on this timer (see ensureProxy) —
-*  a zone drawn in the editor shows up in per-zone stats within one tick. */
-var ZONE_SLICE_RECONCILE_MS = 3e4;
+*  The `device.state-changed` push reaches a forked child through
+*  `createEventBusSliceSource` (the DeviceProxy no longer waits on
+*  `live.onEvent`). Events are still lossy telemetry (D8); this timer
+*  is the RPC reconcile, not the mechanism. Five minutes matches the
+*  viewer's `RECONCILE_MS`. */
+var ZONE_SLICE_RECONCILE_MS = 3e5;
 /** How often the evaluating node re-reads the central scene set. */
 var SCENE_RELOAD_INTERVAL_MS = 3e4;
 /** How long the install coordinates are trusted between settings reads. */
@@ -56998,38 +57316,31 @@ var MOTION_EVENT_HEARTBEAT_MS = 5e3;
 *
 * `thumbnail` joined the clean set on 2026-07-17: the track best-thumbnail is
 * now a subject-centered crop (event-media-dispatcher), and for DEGENERATE
-* tracks (no object event → no `crop`) it is the ONLY subject-centered media —
-* without it a crop-forced request degraded to the `keyFrame` FULL FRAME,
-* which is how 65% of the timeline tiles rendered as whole scenes. It sits
-* right after a real `crop`, before the full-scene `fullFrame`/`keyFrame`.
-*
-* `keyFrameSmall` (the 960px no-box downscale of the best-shot `keyFrame`)
-* joined the clean set on 2026-07-21 so a crop-forced request can degrade to it
-* for tracks whose only clean media is the small key frame; it sits last
-* (fullest-scene, but subject-centered enough to serve as a reasonable fallback
-* over 404). The retired-but-still-stored kinds (`crop`) stay listed so old rows
-* keep resolving.
+* tracks (no object event → no `crop`) it is the ONLY subject-centered media.
+*
+* Full-scene kinds (`fullFrame`, `keyFrame`, `keyFrameSmall`) stay out of
+* this list so a crop is preferred when one exists. `resolveCropForcedMedia`
+* then falls through to those full-scene kinds — a keyFrame beats an icon.
+* An *explicit* `?kind=keyFrame` / `?kind=snapshot` still matches exactly, so
+* videoclips and other kind-specific fetches keep working.
+*
+* The retired-but-still-stored kind (`crop`) stays listed so old rows resolve.
 */
 var CLEAN_MEDIA_KINDS = [
 	"crop",
 	"thumbnail",
-	"thumbnailSmall",
-	"fullFrame",
-	"keyFrame",
-	"keyFrameSmall"
+	"thumbnailSmall"
 ];
 /**
-* Pick a CLEAN (never boxed) media file for a crop-forced request: the exact
-* `preferKind` if it is itself clean and present, else the first available
-* {@link CLEAN_MEDIA_KINDS} frame. Returns undefined when only boxed / no media
-* exists (caller 404s → the viewer shows an icon).
+* Pick media for a crop-forced request: the exact `preferKind` when present
+* (so `?kind=snapshot` still serves a snapshot), else the first available
+* subject crop in {@link CLEAN_MEDIA_KINDS}. Returns undefined when no crop
+* is in the list — the caller then falls through to any remaining image
+* (`resolveCropForcedMedia`); the class icon is only for a total miss.
 */
 function pickCleanMedia(files, preferKind) {
-	const isClean = (k) => CLEAN_MEDIA_KINDS.includes(k);
-	if (isClean(preferKind)) {
-		const exact = files.find((f) => f.kind === preferKind);
-		if (exact) return exact;
-	}
+	const exact = files.find((f) => f.kind === preferKind);
+	if (exact) return exact;
 	for (const kind of CLEAN_MEDIA_KINDS) {
 		const found = files.find((f) => f.kind === kind);
 		if (found) return found;
@@ -58493,6 +58804,19 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				}, trackId);
 			},
 			markEmbeddedFace: (trackId) => stores.trackStore.markEmbeddedFace(trackId),
+			copyCropToTrackPreview: async (input) => {
+				await copyFaceCropIfTrackHasNoThumbnail({
+					listTrackMedia: (trackId) => stores.mediaStore.listByOwner("track", trackId),
+					putTrackThumbnail: (put) => stores.mediaStore.put({
+						deviceId: put.deviceId,
+						ownerKind: "track",
+						ownerId: put.trackId,
+						kind: "thumbnail",
+						timestamp: put.timestamp,
+						data: put.data
+					})
+				}, input);
+			},
 			getKeyFrameMediaKey: (trackId) => this.residents.keyFrameKey(trackId),
 			emitFaceGalleryChanged: (payload) => this.emitFaceGalleryChanged(payload),
 			onSemanticMatch: (match) => this.promoteSemanticRecognition({
@@ -58507,6 +58831,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				confidence: match.confidence,
 				...match.frameHandle !== void 0 ? { frameHandle: match.frameHandle } : {}
 			}),
+			onLiveHierarchy: (input) => this.requestTrackHierarchy(input),
 			logger: logger.child("FaceRecognizer")
 		});
 		this.faceRecognizer.refreshGallery();
@@ -58539,6 +58864,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			deriveCropFromKeyFrame,
 			getKeyFrameMediaKey: (trackId) => this.residents.keyFrameKey(trackId),
 			emitPlateGalleryChanged: (payload) => this.emitPlateGalleryChanged(payload),
+			onLiveHierarchy: (input) => this.requestTrackHierarchy(input),
 			logger: logger.child("PlateRecognizer")
 		});
 		this.plateRecognizer.refreshGallery();
@@ -59908,6 +60234,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			refreshGallery: () => {
 				this.plateRecognizer?.refreshGallery();
 			},
+			eventMediaBaseUrl: () => this.eventMediaBaseUrl,
 			emitPlateGalleryChanged: (payload) => this.emitPlateGalleryChanged(payload)
 		});
 		return [
@@ -60569,6 +60896,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 						hasSnapshot: snapshotTargets.some((t) => t.appendSnapshot)
 					}),
 					holdKeys: heldCaptureKeys,
+					staleAfterMs: ENRICHMENT_CAPTURE_STALE_MS,
 					exec: () => pinnedFramePromise.then((pinnedFrame) => dispatcher.captureForFrame({
 						deviceId,
 						frameHandle,
@@ -60964,7 +61292,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		if (!first) return;
 		const lifeMs = track.lastSeen - track.firstSeen;
 		const moved = netDisplacementPx(track.positions ?? []);
-		if (!isShortMotionlessTrack(lifeMs, moved)) {
+		if (!isShortMotionlessTrack(lifeMs, moved, track.className)) {
 			this.phantomCells?.noteMovingClose({
 				deviceId: track.deviceId,
 				className: track.className,
@@ -61082,6 +61410,7 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					}, d.score, d.label, frame.timestamp);
 					if (this.plateRecognizer) {
 						const mediaSettings = await this.resolveDeviceMediaSettings(deviceId);
+						const body = this.residents.bestSeenBbox(trackId);
 						await this.plateRecognizer.observePlateRead({
 							deviceId,
 							trackId,
@@ -61097,7 +61426,13 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 							frameWidth: frame.frameWidth,
 							frameHeight: frame.frameHeight,
 							cropPadding: mediaSettings.cropPadding,
-							...frame.frameHandle !== void 0 ? { frameHandle: frame.frameHandle } : {}
+							...frame.frameHandle !== void 0 ? { frameHandle: frame.frameHandle } : {},
+							...body !== void 0 ? { bodyBbox: {
+								x: body.x,
+								y: body.y,
+								w: body.w,
+								h: body.h
+							} } : {}
 						});
 					}
 				}
@@ -61398,6 +61733,51 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 			}
 		}).catch(() => {})));
 	}
+	/**
+	* A face or plate crop just landed from a still-live handle. Fill the
+	* missing parent rungs — person/vehicle thumbnail (display crop, same
+	* surface that produced the detail) and native keyFrame — so Events never
+	* has a child crop without a body and a scene.
+	*/
+	requestTrackHierarchy(input) {
+		ensureTrackHierarchyMedia({
+			isThumbnailLanded: (trackId) => this.residents.isThumbnailLanded(trackId),
+			isKeyFrameLanded: (trackId) => this.residents.keyFrameCapture(trackId).landed,
+			captureBodyThumbnail: (req) => this.captureHierarchyBodyThumbnail(req),
+			captureKeyFrame: async (req) => {
+				await this.persistKeyFrames(req.deviceId, req.timestamp, [{
+					trackId: req.trackId,
+					retry: false
+				}], req.frameHandle);
+			}
+		}, input);
+	}
+	async captureHierarchyBodyThumbnail(input) {
+		const displayCrop = this.captureDisplayCropFn;
+		const mediaStore = this.mediaStore;
+		if (!displayCrop || !mediaStore) return;
+		await this.captureScheduler.request({
+			deviceId: input.deviceId,
+			trackId: input.trackId,
+			kind: "thumbnail",
+			coalesceKey: captureCoalesceKey(input.deviceId, "thumbnail", `${input.trackId}:hierarchy`),
+			staleAfterMs: ENRICHMENT_CAPTURE_STALE_MS,
+			exec: async () => {
+				if (this.residents.isThumbnailLanded(input.trackId)) return;
+				const jpeg = await displayCrop(input.frameHandle, input.bodyBbox, input.frameWidth, input.frameHeight, input.cropPadding, input.trackId);
+				if (!jpeg) return;
+				await mediaStore.put({
+					deviceId: input.deviceId,
+					ownerKind: "track",
+					ownerId: input.trackId,
+					kind: "thumbnail",
+					timestamp: input.timestamp,
+					data: jpeg
+				});
+				this.residents.markThumbnailLanded(input.deviceId, input.trackId);
+			}
+		}).catch(() => {});
+	}
 	/** Attribution-time SEMANTIC best-shot promotion (D-semantic-bestshot,
 	*  2026-08-21; see `pipeline/semantic-promotion.ts`): offer a frame from
 	*  which a recognition SUCCEEDED to the best-frame ranking with the
@@ -61446,7 +61826,9 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 		this.captureScheduler.request({
 			deviceId,
 			kind: "thumbnail",
+			trackId,
 			holdKeys: [captureCoalesceKey(deviceId, "thumbnail", trackId)],
+			staleAfterMs: ENRICHMENT_CAPTURE_STALE_MS,
 			exec: async () => {
 				const [pinnedFrame, media] = await Promise.all([pinnedFramePromise, this.resolveDeviceMediaSettings(deviceId)]);
 				const res = await dispatcher.captureForFrame({
@@ -62903,15 +63285,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	* applies to the very next frame even when frames stop briefly
 	* (e.g. during binding flips).
 	*
-	* RECONCILE: the push channel behind `subscribe` (`device.state-changed`
-	* via `live.onEvent`) does not reliably reach a forked addon child — a
-	* zone created AFTER the proxy's cold read stayed invisible until the
-	* addon respawned (live-diagnosed on device 617, 2026-07-16: zone slice
-	* populated hub-side, `zones: []` in every snapshot). Events are lossy
-	* telemetry (D8); the durable channel is RPC + reconcile — so each
-	* proxy also refreshes its two slices on a slow timer. `refresh()`
-	* round-trips `deviceState.getCapSlice` and fans out through the SAME
-	* subscribe callbacks above, so a zone edit lands within one interval.
+	* RECONCILE: the push channel behind `subscribe` is `device.state-changed`
+	* via the addon's `ctx.eventBus` (`createEventBusSliceSource`). That
+	* declares UDS interest so the parent actually fans the slice here. Events
+	* remain lossy (D8); `refresh()` round-trips `deviceState.getCapSlice` on
+	* this timer as the backstop.
 	*/
 	async ensureProxy(deviceId) {
 		const cached = this.proxies.get(deviceId);
@@ -64842,14 +65220,11 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 	async readEventThumbnail(id, preferKind) {
 		const eventFiles = await (this.mediaStore?.listByOwner("event", id) ?? Promise.resolve([]));
 		if (preferKind !== void 0 && preferKind.length > 0) {
-			const trackFiles = await (this.mediaStore?.listByOwner("track", id) ?? Promise.resolve([]));
-			const ownerTrackId = trackFiles.length === 0 ? await (this.eventStore?.getTrackIdForEvent(id) ?? Promise.resolve(null)) : null;
-			const owningTrackFiles = ownerTrackId === null ? [] : await (this.mediaStore?.listByOwner("track", ownerTrackId) ?? Promise.resolve([]));
-			const chosen = resolveCropForcedMedia([
-				...eventFiles,
-				...trackFiles,
-				...owningTrackFiles
-			], (files) => pickCleanMedia(files, preferKind));
+			const layers = await collectCropForcedMedia({
+				listByOwner: (ownerKind, ownerId) => this.mediaStore?.listByOwner(ownerKind, ownerId) ?? Promise.resolve([]),
+				getTrackIdForEvent: (eventId) => this.eventStore?.getTrackIdForEvent(eventId) ?? Promise.resolve(null)
+			}, id);
+			const chosen = resolveCropForcedMedia(layers.bodyFiles, (files) => pickCleanMedia(files, preferKind), layers.detailFiles);
 			if (!chosen) return null;
 			return {
 				bytes: Buffer.from(chosen.base64, "base64"),